The Italian law on artificial intelligence. Five things the European regulation doesn't say.

Italy has had its own AI law since before the AI Act became applicable, and it went almost unnoticed. It touches work, the professions, minors' data, copyright, and it introduces an offence that didn't exist before.

This piece sits within the guide to the AI Act obligations for companies and SMEs and isolates its Italian side. It is written for whoever runs a business, and it ends where a lawyer's work begins.

What it is, what it adds, and why it isn't a transposition

Law No 132 of 23 September 2025 is entitled Provisions and delegations to the Government on artificial intelligence. It was published in the Italian Official Gazette No 223 of 25 September 2025 and came into force on 10 October 2025, fifteen days later.

A European regulation isn't transposed, it applies on its own. That is why Law 132/2025 doesn't translate the AI Act: it places principles alongside it and delegates to the Government the task of building the link with the Italian legal system. Article 1 says so openly, stating that its provisions are interpreted and applied in accordance with Regulation (EU) 2024/1689.

The definitions come from there too. Article 2 refers to Article 3 of the European regulation for AI system and AI model, and adds that for anything not provided for the European definitions apply anyway. Whoever is looking for the meaning of deployer will find it in the glossary of AI and automation, not in this law.

Laid out side by side, the differences show more clearly. The AI Act regulates the product and the role of whoever puts it into circulation; the Italian law enters relationships, that is, work, client, author, injured party.

Subject	What the Italian law says	Relationship with the AI Act
WorkArticles 11 and 12	Inform the worker of the use of AI, with the reference to Legislative Decree 152 of 1997. Safe, transparent, non-discriminatory use. Observatory at the Ministry of Labour.	Italian addition. The AI Act imposes no general obligation to inform employees.
ProfessionsArticle 13	AI only for instrumental activities, with intellectual work prevailing. Communication to the client of the systems used, in clear language.	Italian addition. It has no counterpart in the European regulation.
CopyrightArticle 25	Works of human intellect. Protection for works made with the help of AI only if they are the result of the author's intellectual work.	Italian addition, on a subject the AI Act only touches in passing.
CriminalArticle 26	New Article 612-quater, common aggravating circumstance 11-decies, increased penalty for the deception in Article 294.	Italian addition. The AI Act provides administrative penalties, not offences.
AuthoritiesArticle 20	AgID and ACN designated as National Authorities for AI, with the Bank of Italy, CONSOB and IVASS remaining market surveillance authorities in their sectors.	Implementation: the regulation asks States to designate them, the Italian law does so.

Work: inform, and it isn't an internal memo

Article 11 establishes that the employer or client must inform the worker of the use of artificial intelligence, in the cases and ways of Article 1-bis of Legislative Decree No 152 of 26 May 1997. That reference is the part that weighs, because it points to an information regime that already exists and already carries penalties.

The same article sets four conditions on the use of AI in the employment relationship: it must be safe, reliable and transparent, it can't conflict with human dignity, it can't breach the confidentiality of personal data, and it must guarantee the worker's rights without discrimination based on sex, age, origin, belief, orientation, opinions and personal conditions.

Article 12 sets up at the Ministry of Labour an Observatory on the adoption of AI in the world of work, tasked with defining a strategy, monitoring the impact on the market and promoting the training of workers and employers. It goes together with the literacy obligation of Article 4 of the AI Act, which has already applied since 2 February 2025.

The intellectual professions have to tell the client

Article 13 concerns accountants, lawyers, consultants, architects and anyone practising an intellectual profession. It establishes that the use of AI systems is allowed only for instrumental and support activities, with the intellectual work that is the object of the service prevailing.

The second part is the operational one and almost nobody applies it: to preserve the relationship of trust, information on the AI systems used by the professional is communicated to the client in clear, simple and comprehensive language. It is an obligation to communicate, not an option.

For a business buying professional services, the practical reading is simple: you can ask your consultant which tools they use on your documents, and the Italian law says they must tell you.

Personal data, and a line on children under fourteen

Article 4 requires the use of AI systems to ensure lawful, fair and transparent processing of personal data and compatibility with the purposes for which the data was collected, in accordance with Union law. On the full relationship between the two regimes there is the page on AI Act and GDPR.

The same article requires information on processing to be given in clear and plain language, to ensure that the risks are knowable and the right to object can be exercised. It is a demand for readability, and it puts pressure on privacy notices written not to be read.

Then there is the line on minors, which concerns anyone with a young audience or a service open to the public: access to AI technologies under the age of fourteen, and the resulting processing of data, require the consent of whoever holds parental responsibility.

Copyright now says «human»

Article 25 amends Law 633/1941 by changing a single word, and it changes a lot. In Article 1, protection moves from «works of intellect» to «works of human intellect».

The rule adds that protection also applies to works created with the help of artificial intelligence tools, provided they are the result of the author's intellectual work. The person's creative contribution becomes the condition for protection, and content produced entirely by the machine doesn't obtain it.

For a company producing catalogues, texts or images with generative tools, the consequence is concrete: whatever comes out without a documentable creative contribution risks not being yours in a legal sense, and therefore not being defensible if someone copies it.

The same article inserts Article 70-septies on text and data mining from materials to which there is lawful access, referring to the regime of Articles 70-ter and 70-quater. It concerns those who train models, much more than those who use them.

The new offence, and the aggravating circumstance that applies to all

Article 26 amends the criminal code at three points. The best known is the new Article 612-quater, which punishes with imprisonment from one to five years whoever causes unjust harm to a person by disseminating falsified content about them.

«Whoever causes unjust harm to a person by transferring, publishing or otherwise disseminating, without their consent, images, videos or voices falsified or altered through the use of artificial intelligence systems and capable of misleading as to their authenticity.»
Criminal code, Article 612-quater, introduced by Law 132/2025 (our translation)

The offence is prosecutable on complaint of the injured party, and ex officio when the fact is connected with another offence prosecutable ex officio. The threshold lies in unjust harm and in the capacity to mislead as to the authenticity of the content.

The other two changes matter as much as the first. Article 61 of the criminal code gets the common aggravating circumstance 11-decies, for whoever commits an offence using AI systems as an insidious means or so as to obstruct the defence or aggravate the consequences. In Article 294, on deception, the penalty rises to imprisonment from two to six years when the deception is carried out with AI systems.

Who supervises, and the piece still missing

Article 20 designates AgID and ACN as National Authorities for artificial intelligence. AgID handles notification, assessment, accreditation and monitoring of the bodies that check the conformity of systems. ACN handles supervision, including inspection and penalty activities, also for cybersecurity aspects.

The powers of the Bank of Italy, CONSOB and IVASS as market surveillance authorities remain unaffected, under Article 74(6) of the European regulation. Whoever operates in those sectors looks there before AgID and ACN.

The missing piece is implementation. Article 24 delegates to the Government the adoption of one or more legislative decrees to align national law with the regulation, within twelve months of entry into force, that is, by 10 October 2026, giving the authorities of Article 20 all the supervisory, inspection and penalty powers provided for by the AI Act.

Until those decrees arrive, the Italian penalty framework of the AI Act is incomplete, while the European obligations are already in full force. The regulation's penalties remain those of Article 99, up to €15 million or 3% of worldwide annual turnover for the band that includes transparency, with the lower of the two amounts where SMEs are concerned.

What an SME has to do, in practice

The work this law adds for an ordinary business comes down to four moves, and none requires a project. Whoever already has the list of systems in use has one of them done.

One, tell the people who work for you. If an AI system enters a process that affects people's work, the information must be given beforehand, in the ways of Legislative Decree 152 of 1997. Two, ask the professionals. Your consultant must tell you which systems they use on your documents.

Three, look at the content you publish. Whatever comes out of a generative tool without a documentable creative contribution may not be protected by copyright, and synthetic voices or faces of real people enter an area where an offence exists.

Four, keep the human step. On every automated process that touches a customer, money or an outgoing communication, a person approves before it goes out. Replies on information already approved by the owner can go out on their own, stating that they are a system as Article 50 requires, applicable from 2 August 2026. The extended scope is in the AI principles, the systems we actually use on the AI transparency page.

Questions and answers

This article is an operational overview, not a legal opinion. On specific situations, and in particular on employment relationships and criminal aspects, the answer comes from a professional who looks at your company.